diff --git a/doc/man/bin/lwresd.8 b/doc/man/bin/lwresd.8
new file mode 100644
index 0000000000..7163b0c6ea
--- /dev/null
+++ b/doc/man/bin/lwresd.8
@@ -0,0 +1,166 @@
+.\"
+.\" Copyright (C) 2000  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this document for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $Id: lwresd.8,v 1.4 2000/07/17 17:49:25 gson Exp $
+.\"
+.Dd Jun 30, 2000
+.Dt LWRESD 8
+.Os BIND9 9
+.ds vT BIND 9 Programmer's Manual
+.Sh NAME
+.Nm lwresd
+.Nd lightweight resolver daemon
+.Sh SYNOPSIS
+.Nm lwresd
+.Op Fl C Ar config-file
+.Op Fl d Ar debuglevel
+.Op Fl f g s
+.Op Fl i Ar pid-file
+.Op Fl n Ar #cpus
+.Op Fl P Ar query-port#
+.Op Fl p Ar port#
+.Op Fl t Ar directory
+.Op Fl u Ar user-id
+.Sh DESCRIPTION
+.Nm lwresd
+is the daemon providing name lookup services to clients that use
+the BIND 9 lightweight resolver library.
+It is essentially a stripped-down, caching-only name server that
+answers queries using the BIND 9 lightweight resolver protocol 
+rather than the DNS protocol.
+.Pp
+.Nm lwresd
+listens for resolver queries on a UDP port on the IPv4 loopback 
+interface, 127.0.0.1.
+This means that
+.Nm lwresd
+can only be used by processes running on the local machine.
+By default UDP port number 921 is used for lightweight resolver
+requests and responses.
+.Pp
+Incoming lightweight resolver requests are decoded by
+.Nm lwresd
+which then resolves them using the DNS protocol.
+When the DNS lookup completes,
+.Nm lwresd
+encodes the answers from the name servers in the lightweight
+resolver format and returns them to the client that made the original
+request.
+.Pp
+If
+.Pa /etc/resolv.conf
+contains any
+.Sy nameserver
+entries,
+.Nm lwresd
+sends recursive DNS queries to those servers.  This
+is similar to the use of forwarders in a chaching name
+server.  If no
+.Sy nameserver
+entries are  present, or if forwarding fails,
+.Nm lwresd
+resolves the queries autonomously starting at the 
+root name servers, using a compiled-in list of root 
+servers hints.
+.Pp
+The options to
+.Nm lwresd
+are as follows:
+.Bl -tag -width Ds
+.It Fl C
+use
+.Ar config-file
+as the configuration file instead of the default,
+.Pa /etc/resolv.conf .
+.It Fl d
+set the daemon's debug level to
+.Ar debuglevel .
+Debugging traces from
+.Nm lwresd
+become more verbose as the debug level increases.
+.It Fl f
+run
+.Nm lwresd
+in the foreground.
+.It Fl g
+run
+.Nm lwresd
+in the foreground and force all logging to
+.Dv stderr .
+.It Fl i
+write the daemon's process id to
+.Ar pid-file
+instead of the default pathname.
+.It Fl n
+create 
+.Ar #cpus
+worker threads to take advantage of multiple CPUs.
+If no option is given,
+.Nm lwresd
+will try to determine the number of CPUs present and create
+one thread per CPU.  If
+.Nm lwresd
+is unable to determine the number of CPUs, a single worker thread
+is created.
+.It Fl P
+send DNS lookups to port number
+.Ar query-port#
+when querying name servers.
+This provides a way of testing the lightweight resolver daemon with a
+name server that listens for queries on a non-standard port number.
+.It Fl p
+listen for lightweight resolver queries on the loopback interface
+using UDP port
+.Ar port#
+instead of the default port number, 921.
+.It Fl s
+write memory usage statistics to
+.Dv stdout
+on exit.
+This option is only of interest to BIND 9 developers and may be
+removed or changed in a future release.
+.It Fl t
+tells
+.Nm lwresd
+to chroot() to
+.Ar directory
+immediately after reading its configuration file.
+.It Fl u
+run
+.Nm lwresd
+as
+.Ar user-id ,
+which is a user name or numeric id that must be present in the
+password file.
+The lightweight resolver daemon will change its user-id after it has
+carried out any privileged operations, such as writing the process-id
+file or binding a socket to a privileged port (typically any port
+less than 1024).
+.El
+.Sh FILES
+.Bl -tag -width  /var/run/lwresd.pid -compact
+.It Pa /etc/resolv.conf
+default configuration file
+.It Pa /var/run/lwresd.pid
+default process-id file
+.El
+.Sh SEE ALSO
+.Xr named 8 ,
+.Xr lwres 3 .
+.Sh NOTES
+.Nm lwresd
+is a daemon for lightweight resolvers, not a lightweight daemon
+for resolvers.
diff --git a/doc/man/bin/named.8 b/doc/man/bin/named.8
new file mode 100644
index 0000000000..51d464e943
--- /dev/null
+++ b/doc/man/bin/named.8
@@ -0,0 +1,171 @@
+.\"
+.\" Copyright (C) 2000  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this document for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $Id: named.8,v 1.3 2000/07/12 02:07:32 gson Exp $
+.\"
+.Dd Jun 30, 2000
+.Dt NAMED 8
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm named
+.Nd Internet domain name server (DNS)
+.Sh SYNOPSIS
+.Nm named
+.Op Fl c Ar config-file
+.Op Fl d Ar debuglevel
+.Op Fl f g s
+.Op Fl n Ar #cpus
+.Op Fl p Ar port#
+.Op Fl t Ar directory
+.Op Fl u Ar user-id
+.Op Fl x Ar cache-file
+.Sh DESCRIPTION
+.Nm named
+is the ISC implementation of an Internet domain name server.
+See RFCs 1033, 1034, and 1035 for more information on the Internet
+domain name system.
+For historical reasons, the ISC's DNS software is known as BIND -
+Berkeley Internet Name Daemon - because it was originally
+supplied with BSD
+.Ux
+releases.
+.Pp
+Without any arguments,
+.Nm named
+will read the default configuration file
+.Pa /etc/named.conf ,
+read any initial data, and listen for queries.
+It is also possible to use the BIND9 name server
+as a lightweight resolver server
+.Nm lwresd .
+However when operating as a lightweight resolver server,
+.Nm named
+is functionally and logically distinct from a
+conventional name server.
+More information can be found in 
+.Xr lwresd 8 .
+.Pp
+Although some command-line options can be used with
+.Nm named ,
+the name server's behaviour is mainly controlled by its configuration file, 
+.Pa /etc/named.conf .
+Refer to the BIND9 Administrator Reference Manual for further details.
+.Pp
+The options to
+.Nm named
+are as follows:
+.Bl -tag -width Ds
+.It Fl c
+use
+.Ar config-file
+as the configuration file instead of the default,
+.Pa /etc/named.conf .
+.It Fl d
+set the daemon's debug level to
+.Ar debuglevel .
+Debugging traces from
+.Nm named
+become more verbose as the debug level increases.
+.It Fl f
+run
+.Nm named
+in the foreground.
+.It Fl g
+run
+.Nm named
+in the foreground and force all logging to
+.Dv stderr .
+.It Fl n
+create 
+.Ar #cpus
+worker threads to take advantage of multiple CPUs.
+If no option is given,
+.Nm named
+will try to determine the number of CPUs present and create
+one thread per CPU.  If
+.Nm named
+is unable to determine the number of CPUs, a single worker thread
+is created.
+.It Fl p
+listen for queries on  port
+.Ar port#
+instead of the default port number, 53.
+.It Fl s
+write memory usage statistics to
+.Dv stdout
+on exit.
+This option is mainly of interest
+to BIND9 developers and may be removed or changed in a future release.
+.It Fl t
+tells
+.Nm named
+to chroot() to
+.Ar directory
+immediately after reading its config file.
+.It Fl u
+run
+.Nm named
+as UID
+.Ar user-id .
+.Nm named
+will change its UID after it has
+carried out any privileged operations, such as 
+creating sockets that listen on privileged ports.
+.It Fl x
+load data from
+.Ar cache-file .
+into the cache of the default view.
+This option must not be used.
+It is only of interest
+to BIND9 developers and may be removed or changed in a future release.
+.El
+.Sh SIGNALS
+In routine operation, signals should not be used to \*qcontrol\*q the
+name server.
+.Nm rndc
+should be used instead.
+Sending the name server a
+.Dv SIGHUP
+signal forces a reload of the server.
+A
+.Dv SIGINT
+or
+.Dv SIGTERM
+signal can be used to gracefully shut down the server.
+Sending any other signals to the name server
+will have an undefined outcome.
+.\".Sh CONFIGURATION FILE FORMAT
+.\".Nm named 's
+.\"configuration file is too complex to describe in detail here.
+.\"A complete description is provided in the BIND9 Administrator
+.\"Reference Manual.
+.Sh FILES
+.Bl -tag -width  /var/run/named.pid -compact
+.It Pa /etc/named.conf
+default configuration file
+.It Pa /var/run/named.pid
+default process-id file
+.El
+.Sh SEE ALSO
+.Xr RFC1033 ,
+.Xr RFC1034 ,
+.Xr RFC1035 ,
+.Xr named.conf 5 ,
+.Xr zonefile 5 ,
+.Xr rndc 8 ,
+.Xr lwresd 8 ,
+BIND9 Administrator Reference Manual, June 2000.
diff --git a/doc/man/bin/rndc.8 b/doc/man/bin/rndc.8
new file mode 100644
index 0000000000..5518d13d81
--- /dev/null
+++ b/doc/man/bin/rndc.8
@@ -0,0 +1,166 @@
+.\" Copyright (C) @YEARS@  Internet Software Consortium.
+.\" 
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\" 
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+.\" SOFTWARE.
+.\" 
+.\" $Id: rndc.8,v 1.6 2000/07/12 16:48:19 gson Exp $
+.\" 
+.Dd Jun 30, 2000
+.Dt RDNC 8
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm rdnc
+.Nd name server control utility
+.Sh SYNOPSIS
+.Nm rndc
+.Op Fl c Ar config-file
+.Op Fl M
+.Op Fl m
+.Op Fl p Ar port#
+.Op Fl s Ar server
+.Op Fl v
+.Op Fl y Ar key_id
+.Ar command .... 
+.Sh DESCRIPTION
+This command allows the system administrator to control the operation
+of a name server.
+It supersedes the
+.Xr ndc 8
+utility that was provided in old BIND releases.
+If
+.Nm rndc
+is invoked with no command line options or arguments, it
+prints a short summary of the supported commands and the available
+options and their arguments.
+.Pp
+.Nm rndc
+communicates with the name server over a TCP connection, 
+sending commands authenticated with digital signatures. 
+In the current versions of
+.Nm rndc
+and 
+.Xr named 8
+the only supported encryption algorithm is HMAC-MD5, which uses a
+shared secret on each end of the connection.
+This provides TSIG-style authentication for the command request
+and the name server's response. 
+All commands sent over the channel
+must be signed by a key_id known to the server.
+.Pp
+.Nm rndc
+reads its default configuration file,
+.Pa /etc/rndc.conf
+to determine how to contact the name server and decide what algorithm
+and keys is should use.
+The
+.Fl c
+option can be used to specify an alternate configuration file.
+.Pp
+.Ar server
+is the name or address of the server which matches a
+.Dv server{}
+statement in the configuration file for
+.Nm rndc .
+If no
+.Ar server
+is supplied on the command line, the host named by the
+.Dv default-server
+clause in the
+.Dv options{}
+statement of the configuration file will be used.
+.Pp
+The
+.Fl p
+option can be used to make
+.Nm rndc
+send commands to TCP port number
+.Ar port#
+on the system running the name server instead of BIND 9's 
+default control channel port of 953.
+.Pp
+The
+.Fl y
+option identifies the
+.Ar key_id
+to use from the configuration file.
+.Ar key_id
+must be known by
+.Xr named
+with the same algorithm and secret string in order for
+control message validation to succeed.
+If no
+.Fl y
+option is provided,
+.Nm rndc
+will first look for a 
+.Dv key
+clause in the
+.Dv server{}
+statement of the server being used, or if no
+.Dv server{}
+statement is present for that host, then the
+.Dv default-key
+clause of the
+.Dv options{}
+statement.
+Note that the configuration file for
+.Nm rdnc
+contains shared secrets which are used to send authenticated
+control commands to name servers.
+It should therefore not have general read or write access.
+.Pp
+The
+.Fl M ,
+.Fl m ,
+and
+.Fl v
+options provided debugging information and are primarily of interest
+only to the BIND 9 developers.
+They might be changed or removed in future releases.
+.Pp
+The only valid value for
+.Ar command
+is \*qreload\*q, which forces the name server to reload its configuation
+file and zones.
+Further commands will be provided in future releases as the management
+capabilities of
+.Nm rndc
+are extended.
+.Sh LIMITATIONS
+.Nm rndc
+currently only supports the
+.Dv reload
+command.
+Future releases will provide more commands so that
+.Nm rndc
+offers at least as many management capabilities as the old
+.Xr ndc
+utility.
+.Pp
+There is currently no way to provide the shared secret for a key_id 
+without using the configuration file.
+.Pp
+Several error messages could be clearer.
+For example, trying to connect
+from an address that is not in the list of acceptable addresses
+configured into
+.Xr named
+will result in the error message "end of file" when the server
+unceremoniously closes the connection.
+.Sh SEE ALSO
+.Xr rndc.conf 5 ,
+.Xr named 8 ,
+.Xr named.conf 5 ,
+.Xr RFC2845 ,
+.Xr ndc 8 .
diff --git a/doc/man/bin/rndc.conf.5 b/doc/man/bin/rndc.conf.5
new file mode 100644
index 0000000000..010b5e1dc2
--- /dev/null
+++ b/doc/man/bin/rndc.conf.5
@@ -0,0 +1,202 @@
+.\" Copyright (C) @YEARS@  Internet Software Consortium.
+.\" 
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\" 
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+.\" SOFTWARE.
+.\" 
+.\" $Id: rndc.conf.5,v 1.4 2000/07/12 17:37:57 gson Exp $
+.\" 
+.Dd Jun 30, 2000
+.Dt RDNC.CONF 5
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm rdnc.conf
+.Nd rdnc configuration file
+.Sh SYNOPSIS
+.Nm rdnc.conf
+.Sh DESCRIPTION 
+The BIND9 utility for controlling the name server,
+.Nm rndc ,
+has its own configuration file
+.Pa /etc/rndc.conf .
+This file has a similar structure and syntax to
+.Pa named.conf ,
+the file used to configure the name server.
+Statements are enclosed in braces and terminated with a semi-colon.
+Clauses in the statements are also semi-colon terminated.
+The usual comment styles are supported:
+.Bl -tag -width UNIX-style:
+.It C style: /* */
+.It C++ style: // to end of line
+.It Unix style: # to end of line
+.El
+.Pp
+.Pa rndc.conf
+is much simpler than
+.Pa named.conf .
+The file uses three statements: an
+.Dv options{}
+statement, a
+.Dv server{}
+statement and a
+.Dv key{}
+statement.
+.Pp
+The
+.Dv options{}
+statement contains two clauses.
+The
+.Dv default-server
+clause
+is followed by the name or address of a name server.
+This host will
+be used when no name server is given as an argument to
+.Nm rndc .
+The
+.Dv default-key
+clause
+is followed by the name of a key which is identified by a 
+.Dv key{}
+statement.
+If no 
+.Fl y
+option is provided on the
+.Xr rndc 
+command line, and no
+.Dv key
+clause is found in a a matching
+.Dv server{}
+statement, this default key will be used to authenticate the server's
+commands and responses.
+.Pp
+After the keyword
+.Dv server ,
+the 
+.Dv server{}
+statement is followed by a string which is the hostname or address for a
+name server.
+The statement has a single clause,
+.Dv key .
+The key name must match the name of a
+.Dv key{}
+statement in the file.
+.Pp
+The
+.Dv key{}
+statement begins with an identifying string, the name of the key.
+The statement has two clauses.
+.Dv algorithm
+identifies the encryption algorithm for
+.Nm rndc
+to use; currently only HMAC-MD5 is supported.
+This is followed by a 
+.Dv secret
+clause which contains the base-64 encoding of the
+algorithm's encryption key.
+The base-64 string is enclosed in double quotes.
+.Pp
+There are two common ways to generate the base-64 string for the
+.Dv secret .
+The BIND 9 program
+.Xr dnssec-keygen 8
+can be used to generate a random key, or the
+.Xr mmencode 1
+program, also known as
+.Xr mimencode 1 ,
+can be used to generate a base-64 string from known input.
+.Xr mmencode
+does not ship with BIND 9 but is available on many systems.
+See the
+.Sx EXAMPLES
+section for sample command lines for each.
+.Pp
+Host and key names must be quoted using double quotes if they
+match a keyword, such as having a key named "key".
+.Sh EXAMPLE
+.Bd -literal indent
+options {
+    default-server  localhost;
+    default-key     samplekey;
+};
+
+server localhost {
+    key     samplekey;
+};
+
+key samplekey {
+    algorithm hmac-md5;
+    secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
+};
+.Ed
+.Pp
+In the above example,
+.Nm rndc
+will by default use the server at localhost (127.0.0.1) and the key called
+.Dv samplekey .
+Commands to the localhost server will use the
+.Dv samplekey
+key.
+The
+.Dv key{}
+statement indicates that
+.Dv samplekey
+uses the HMAC-MD5 algorithm and its
+.Dv secret
+clause contains the base-64 encoding of the HMAC-MD5 secret enclosed
+in double quotes.
+.Pp
+To generate a random secret with
+.Xr dnssec-keygen :
+.Bd -literal indent
+$ dnssec-keygen -a hmac-md5 -b 128 -n user rndc
+.Ed
+.Pp
+The base-64 string will appear in two files, 
+.Pa Krndc.+157.+{random}.key
+and 
+.Pa Krndc.+157.+{random}.private .
+After extracting the key to be
+placed in the
+.Nm rndc.conf
+and
+.Xr named.conf
+.Dv key{}
+statements, the
+.Pa .key
+and
+.Pa .private
+files can be removed.
+.Pp
+To generate a secret from known input with
+.Xr mmenode :
+.Bd -literal indent
+$ echo "known plaintext for a secret" | mmencode
+.Ed
+.Sh LIMITATIONS
+There is currently no way to specify the port for
+.Xr rndc
+to use.  This will be remedied in future releases by allowing a
+.Dv port
+clause to the
+.Dv server{}
+statement and a
+.Dv default-port
+clause to the
+.Dv options{}
+statement.
+.Sh SEE ALSO
+.Xr rndc 8 ,
+.Xr named.conf 8 ,
+.Xr dnssec-keygen 8 ,
+.Xr mmencode 1 ,
+"BIND9 Administrators Manual".
diff --git a/doc/man/dnssec/dnssec-keygen.8 b/doc/man/dnssec/dnssec-keygen.8
new file mode 100644
index 0000000000..899d865ebf
--- /dev/null
+++ b/doc/man/dnssec/dnssec-keygen.8
@@ -0,0 +1,304 @@
+.\"
+.\" Copyright (C) 2000  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this document for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $Id: dnssec-keygen.8,v 1.5 2000/07/26 18:52:05 gson Exp $
+.\"
+.Dd Jun 30, 2000
+.Dt DNSSEC-KEYGEN 8
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm dnssec-keygen
+.Nd key generation tool for DNSSEC
+.Sh SYNOPSIS
+.Nm dnssec-keygen
+.Fl a Ar algorithm
+.Fl b Ar keysize
+.Op Fl e
+.Op Fl g Ar generator
+.Op Fl h
+.Fl n Ar nametype
+.Op Fl p Ar protocol-value
+.Op Fl r Ar randomdev
+.Op Fl s Ar strength-value
+.Op Fl t Ar type
+.Op Fl v Ar level
+.Ar name
+.Sh DESCRIPTION
+.Nm dnssec-keygen
+generates keys for DNSSEC, Secure DNS, as defined in RFC2535.
+It also generates keys for use in Transaction Signatures, TSIG, which
+is defined in RFC2845.
+.Pp
+A short summary of the options and arguments to
+.Nm dnssec-keygen
+is printed by the
+.Fl h
+(help) option.
+.Pp
+The
+.Fl a ,
+.Fl b ,
+and
+.Fl n
+options and their arguments must be supplied when generating keys.
+The domain name that the key has to be generated for is given by
+.Ar name .
+.Pp
+The choice of encryption algorithm is selected by the
+.Fl a
+option to
+.Nm dnssec-keygen .
+.Ar algorithm
+must be one of
+.Dv RSAMD5 ,
+.Dv DH ,
+.Dv DSA
+or
+.Dv HMAC-MD5
+to indicate that an RSA, Diffie-Hellman, Digital Signature
+Algorithm or HMAC-MD5 key is required.
+An argument of
+.Dv RSA
+can also be given, which is equivalent to
+.Dv RSAMD5 .
+The argument identifying the encryption algorithm is case-insensitive.
+DNSSEC specifies DSA as a mandatory algorithm and RSA as a recommended one.
+Implementations of TSIG must support HMAC-MD5.
+.Pp
+The number of bits in the key is determined by the
+.Ar keysize
+argument following the
+.Fl b
+option.
+The choice of key size depends on the algorithm that is used.
+RSA keys must be between 512 and 2048 bits.
+Diffie-Hellman keys must be between 128 and 4096 bits.
+For DSA, the key size must be between 512 and 1024 bits and a multiple
+of 64.
+The length of an HMAC-MD5 key can be between 1 and 512 bits.
+.Pp
+The
+.Fl n
+option specifies how the generated key will be used.
+.Ar nametype
+can be either
+.Dv ZONE ,
+.Dv HOST , 
+.Dv ENTITY ,
+or
+.Dv USER
+to indicate that the key will be used for signing a zone, host,
+entity or user respectively.
+In this context
+.Dv HOST
+and
+.Dv ENTITY
+are identical.
+.Ar nametype
+is case-insensitive.
+.Pp
+The
+.Fl e
+option can only be used when generating RSA keys.
+It tells
+.Nm dnssec-keygen
+to use a large exponent.
+When creating Diffie-Hellman keys, the
+.Fl g
+option selects the Diffie-Hellman generator
+.Ar generator
+that is to be used.
+The only supported values value of
+.Ar generator
+are 2 and 5.
+If no Diffie-Hellman generator is supplied, a known prime 
+from RFC2539 will be used if possible; otherwise 2 will be used as the
+generator.
+.Pp
+The
+.Fl p
+option sets the protocol value for the generated key to
+.Ar protocol-value .
+The default is 2 (email) for keys of type
+.Dv USER 
+and 3 (DNSSEC) for all other key types.
+Other possible values for this argument are listed in RFC2535 and its
+successors.
+.Pp
+.Nm dnssec-keygen
+uses random numbers to seed the process
+of generating keys.
+If the system does not have a
+.Pa /dev/random
+device that can be used for generating random numbers,
+.Nm dnssec-keygen
+will prompt for keyboard input and use the time intervals between
+keystrokes to provide randomness.
+The
+.Fl r
+option overrides this behaviour, making 
+.Nm dnssec-keygen
+use
+.Ar randomdev
+as a source of random data.
+.Pp
+The key's strength value can be set with the
+.Fl s
+option.
+The generated key will sign DNS resource records
+with a strength value of
+.Ar strength-value .
+It should be a number between 0 and 15.
+The default strength is zero.
+The key strength field currently has no defined purpose in DNSSEC.
+.Pp
+The
+.Fl t
+option indicates if the key is to be used for authentication or
+confidentiality.
+.Ar type
+can be one of
+.Dv AUTHCONF ,
+.Dv NOAUTHCONF ,
+.Dv NOAUTH 
+or
+.Dv NOCONF .
+The default is
+.Dv AUTHCONF .
+If type is
+.Dv AUTHCONF 
+the key can be used for authentication and confidentialty.
+Setting
+.Ar type 
+to
+.Dv NOAUTHCONF
+indicates that the key cannot be used for authentication or confidentialty.
+A value of
+.Dv NOAUTH
+means the key can be used for confidentiality but not for
+authentication.
+Similarly,
+.Dv NOCONF
+defines that the key cannot be used for confidentiality though it can
+be used for authentication.
+.Pp
+The 
+.Fl v
+option can be used to make
+.Nm dnssec-keygen
+more verbose.
+As the debugging/tracing level
+.Ar level
+increases, 
+.Nm dnssec-keygen
+generates increasingly detailed reports about what it is doing.
+The default level is zero.
+.Sh GENERATED KEYS
+When
+.Nm dnssec-keygen
+completes it prints a string of the form
+.Ar Knnnn.+aaa+iiiii
+on the standard output.
+This is an identification string for the key it has generated.
+These strings can be supplied as arguments to
+.Xr dnssec-makekeyset 8 .
+.Pp
+The
+.Ar nnnn.
+part is the dot-terminated domain name given by
+.Ar name .
+The DNSSEC algorithm identifier is indicated by
+.Ar aaa -
+001 for RSA, 002 for Diffie-Hellman, 003 for DSA or 157 for HMAC-MD5.
+.Ar iiiii
+is a five-digit number identifying the key.
+.Pp
+.Nm dnssec-keygen
+creates two files.
+The file names are adapted from the key identification string above.
+They have names of the form:
+.Ar Knnnn.+aaa+iiiii.key
+and
+.Ar Knnnn.+aaa+iiiii.private .
+These contain the public and private parts of the key respectively.
+The files generated by
+.Nm dnssec-keygen
+obey this naming convention to
+make it easy for the signing tool
+.Xr dnssec-signzone 8
+to identify which file(s) have to be read to find the necessary
+key(s) for generating or validating signatures.
+.Pp
+The
+.Ar .key
+file contains a KEY resource record that can be inserted into a zone file
+with a 
+.Dv $INCLUDE
+statement.
+The private part of the key is in the
+.Ar .private
+file.
+It contains details of the encryption algorithm that was used and any
+relevant parameters: prime number, exponent, modulus, subprime, etc.
+For obvious security reasons, this file does not have general read
+permission.
+The private part of the key is used by
+.Xr dnssec-signzone 8
+to generate signatures and the public part is used to verify the
+signatures.
+Both 
+.Ar .key
+and
+.Ar .private
+key files are generated for symmetric encryption algorithm such as
+HMAC-MD5, even though the public and private key are equivalent.
+.Sh EXAMPLE
+To generate a 768-bit DSA key for the domain
+.Dv example.com ,
+the following command would be issued:
+.Pp
+.Dl # dnssec-keygen -a DSA -b 768 -n ZONE example.com
+.Dl Kexample.com.+003+26160
+.Pp
+.Nm dnssec-keygen
+has printed the key identification string
+.Dv Kexample.com.+003+26160 ,
+indicating a DSA key with identifier 26160.
+It will also have created the files
+.Pa Kexample.com.+003+26160.key 
+and
+.Pa Kexample.com.+003+26160.private
+containing respectively the public and private keys for the generated
+DSA key.
+.Sh FILES
+.Pa /dev/random 
+.Sh SEE ALSO
+.Xr RFC2535,
+.Xr RFC2845,
+.Xr RFC2539,
+.Xr dnssec-makekeyset 8 ,
+.Xr dnssec-signkey 8 ,
+.Xr dnssec-signzone 8 .
+.Sh BUGS
+The naming convention for the public and private key files is a little
+clumsy.
+It won't work for domain names that are longer than 236 characters
+because of the 
+.Ar .+aaa+iiiii.private
+suffix results in filenames that are too long for most
+.Ux
+systems.
diff --git a/doc/man/dnssec/dnssec-makekeyset.8 b/doc/man/dnssec/dnssec-makekeyset.8
new file mode 100644
index 0000000000..9998174666
--- /dev/null
+++ b/doc/man/dnssec/dnssec-makekeyset.8
@@ -0,0 +1,202 @@
+.\"
+.\" Copyright (C) 2000  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this document for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $Id: dnssec-makekeyset.8,v 1.4 2000/07/26 00:47:14 bwelling Exp $
+.\"
+.Dd Jun 30, 2000
+.Dt DNSSEC-MAKEKEYSET 8
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm dnssec-makekeyset
+.Nd produce a set of DNSSEC keys
+.Sh SYNOPSIS
+.Nm dnssec-makekeyset
+.Op Fl h
+.Op Fl s Ar start-time
+.Op Fl e Ar end-time
+.Op Fl t Ar TTL
+.Op Fl r Ar randomdev
+.Op Fl v Ar level
+.Ar keyfile ....
+.Sh DESCRIPTION
+.Nm dnssec-makekeyset
+generates a key set from one or more keys created by
+.Xr dnssec-keygen 8 .
+It creates a file containing KEY and SIG records for some zone which
+can then be signed by the zone's parent if the parent zone is
+DNSSEC-aware.
+.Ar keyfile
+should be a key identification string as reported by
+.Xr dnssec-keygen 8 :
+i.e.
+.Ar Knnnn.+aaa+iiiii
+where
+.Ar nnnn
+is the name of the key,
+.Ar aaa
+is the encryption algorithm and
+.Ar iiiii
+is the key identifier.
+Multiple
+.Ar keyfile
+arguments can be supplied when there are several keys to be combined
+by
+.Nm dnssec-makekeyset
+into a key set.
+.Pp
+For any SIG records that are in the key set, the start time when the
+SIG records become valid is specified with the
+.Fl s
+option.
+.Ar start-time
+can either be an absolute or relative date.
+An absolute start time is indicated by a number in YYYYMMDDHHMMSS
+notation: 20000530144500 denotes 14:45:00 UTC on May 30th, 2000.
+A relative start time is supplied when
+.Ar start-time
+is given as +N: N seconds from the current time.
+If no
+.Fl s 
+option is supplied, the current date and time is used for the start
+time of the SIG records.
+.Pp
+The expiry date for the SIG records can be set by the
+.Fl e
+option.
+Note that in this context, the expiry date specifies when the SIG
+records are no longer valid, not when they are deleted from caches on name
+servers.
+.Ar end-date
+also represents an absolute or relative date.
+YYYYMMDDHHMMSS notation is used as before to indicate an absolute date
+and time.
+When
+.Ar end-date
+is +N,
+it indicates that the SIG records will expire in N seconds after their
+start date.
+If
+.Ar end-date
+is written as now+N,
+the SIG records will expire in N seconds after the current time.
+When no expiry date is set for the SIG records,
+.Nm dnssec-makekeyset
+defaults to an expire time of 30 days from the start time of the SIG
+records.
+.Pp
+An alternate source of random data can be specified with the
+.Fl r
+option.
+.Ar randomdev
+is the name of the file to use to obtain random data.
+By default
+.Pa /dev/random
+is used if this device is available.
+If it is not provided by the operating system and no
+.Fl r
+option is used,
+.Nm dnssec-makekeyset
+will prompt the user for input from the keyboard and use the time
+between keystrokes to derive some random data.
+.Pp
+The
+.Fl t
+option is followed by a time-to-live argument
+.Ar TTL
+which indicates the TTL value that will be assigned to the assembled KEY
+and SIG records in the output file.
+.Ar TTL
+is expressed in seconds.
+If no
+.Fl t
+option is provided,
+.Nm dnssec-makekeyset
+prints a warning and uses a default TTL of 3600 seconds.
+.Pp
+The
+.Fl v
+option can be used to make
+.Nm dnssec-makekeyset
+more verbose.
+As the debugging/tracing level
+.Ar level
+increases,
+.Nm dnssec-makekeyset
+generates increasingly detailed reports about what it is doing.
+The default level is zero. 
+.Pp
+The
+.Fl h
+option makes
+.Nm dnssec-makekeyset
+to print a short summary of its options and arguments.
+.Pp
+If
+.Nm dnssec-makekeyset
+is successful, it creates a file name of the form
+.Ar nnnn.keyset .
+This file contains the KEY and SIG records for domain
+.Dv nnnn ,
+the domain name part from the key file identifier produced when
+.Nm dnssec-keygen
+created the domain's public and private keys.
+The
+.Ar .keyset
+file can then be transferred to the DNS administrator of the parent
+zone for them to sign the contents with
+.Xr dnssec-signkey 8 .
+.Sh EXAMPLE
+The following command generates a key set for the DSA key for
+.Dv example.com
+that was shown in the
+.Xr dnssec-keygen 8
+man page.
+The backslash is for typographic reasons and would not be provided on
+the command line when running
+.Nm dnssec-makekeyset .
+.nf
+.Dl # dnssec-makekeyset -t 86400 -s 20000701120000 \e\p 
+.Dl -e +2592000 Kexample.com.+003+26160
+.fi
+.Pp
+.Nm dnssec-makekeyset
+will create a file called
+.Pa example.com.keyset
+containing a SIG and KEY record for
+.Dv example.com.
+These records will have a TTL of 86400 seconds (1 day).
+The SIG record becomes valid at noon UTC on July 1st 2000 and expires
+30 days (2592000 seconds) later.
+.Pp
+The DNS administrator for
+.Dv example.com
+could then send
+.Pa example.com.keyset
+to the DNS administrator for
+.Dv .com
+so that they could sign the resource records in the file.
+This assumes that the
+.Dv .com 
+zone is DNSSEC-aware and the administrators of the two zones have some
+mechanism for authenticating each other and exchanging the keys and
+signatures securely.
+.Sh FILES
+.Pa /dev/random .
+.Sh SEE ALSO
+.Xr RFC2535 ,
+.Xr dnssec-keygen 8 ,
+.Xr dnssec-signkey 8 .
diff --git a/doc/man/dnssec/dnssec-signkey.8 b/doc/man/dnssec/dnssec-signkey.8
new file mode 100644
index 0000000000..bd180f0f97
--- /dev/null
+++ b/doc/man/dnssec/dnssec-signkey.8
@@ -0,0 +1,159 @@
+.\"
+.\" Copyright (C) 2000  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this document for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $Id: dnssec-signkey.8,v 1.5 2000/07/26 19:13:18 gson Exp $
+.\"
+.Dd Jun 30, 2000
+.Dt DNSSEC-SIGNKEY 8
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm dnssec-signkey
+.Nd DNSSEC keyset signing tool
+.Sh SYNOPSIS
+.Nm dnssec-signkey
+.Op Fl h
+.Op Fl p
+.Op Fl r Ar randomdev
+.Op Fl v Ar level
+.Ar keyset
+.Ar keyfile ...
+.Sh DESCRIPTION
+.Nm dnssec-signkey
+is used to sign a key set for a child zone.
+Typically this would be provided by a 
+.Ar .keyset
+file generated by
+.Xr dnssec-makekeyset 8 .
+This provides a mechanism for a DNSSEC-aware zone to sign the keys of
+any DNSSEC-aware child zones.
+The child zone's key set gets signed with the zone keys for its parent
+zone.
+.Ar keyset
+will be the pathname of the child zone's
+.Ar .keyset
+file.
+Each
+.Ar keyfile
+argument will be a key identification string as reported by
+.Xr dnssec-keygen 8
+for the parent zone.
+This allows the child's keys to be signed by more than one 
+parent zone key.
+.Pp
+The
+.Fl h
+option makes
+.Nm dnssec-signkey
+print a short summary of its command line options
+and arguments.
+.Pp
+The
+.Fl p
+option instructs
+.Nm dnssec-signkey
+to use pseudo-random data when signing the keys.  This is faster, but
+less secure, than using genuinely random data for signing.
+This option may be useful when there are many child zone keysets to
+sign or if the entropy source is limited.
+It could also be used for short-lived keys and signatures that don't
+require as much protection against cryptanalysis, such as when the key
+will be discarded long before it could be compromised.
+.Nm dnssec-signkey
+may need random numbers in the process of generating keys.
+If the system does not have a
+.Pa /dev/random
+device that can be used for generating random numbers,
+.Nm dnssec-signkey
+will prompt for keyboard input and use the time intervals between
+keystrokes to provide randomness.
+The
+.Fl r
+option overrides this behaviour, making
+.Nm dnssec-signkey
+use
+.Ar randomdev
+as a source of random data.
+.Pp
+The
+.Fl v
+option can be used to make
+.Nm dnssec-signkey
+more verbose.
+As the debugging/tracing level
+.Ar level
+increases,
+.Nm dnssec-signkey
+generates increasingly detailed reports about what it is doing.
+The default level is zero.
+.Pp
+When
+.Nm dnssec-signkey
+completes successfully, it generates a file called
+.Ar nnnn.signedkey
+containing the signed keys for child zone
+.Ar nnnn .
+The keys from the
+.Ar keyset
+file will have been signed by the parent zone's key or keys which were
+supplied as
+.Ar keyfile
+arguments.
+This file should be sent to the DNS administrator of the child zone.
+They arrange for its contents to be incorporated into the zone file
+when it next gets signed with
+.Xr dnssec-signzone 8 .
+A copy of the generated
+.Ar signedkey
+file should be kept by the parent zone's DNS administrator, since
+it will be needed when signing the parent zone.
+.Sh EXAMPLE
+The DNS administrator for a DNSSEC-aware
+.Dv .com
+zone would use the following command to make
+.Nm dnssec-signkey
+sign the
+.Ar .keyset
+file for
+.Dv example.com
+created in the example shown in the man page for
+.Xr dnssec-makekeyset 8 :
+.Pp
+.Dl # dnssec-signkey example.com.keyset Kcom.+003+51944
+.Pp
+where
+.Dv Kcom.+003+51944
+was a key file identifier that was produced when
+.Xr dnssec-keygen 8
+generated a key for the
+.Dv .com
+zone.
+.Pp
+.Nm dnssec-signkey
+will produce a file called
+.Dv example.com.signedkey
+which has the keys for
+.Dv example.com
+signed by the
+.Dv com
+zone's zone key.
+.Sh FILES
+.Pa /dev/random
+.Sh SEE ALSO
+.Xr RFC2535,
+.Xr dnssec-keygen 8 ,
+.Xr dnssec-makekeyset 8 ,
+.Xr dnssec-signzone 8 .
diff --git a/doc/man/dnssec/dnssec-signzone.8 b/doc/man/dnssec/dnssec-signzone.8
new file mode 100644
index 0000000000..c7bf4dd866
--- /dev/null
+++ b/doc/man/dnssec/dnssec-signzone.8
@@ -0,0 +1,263 @@
+.\"
+.\" Copyright (C) 2000  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this document for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $Id: dnssec-signzone.8,v 1.7 2000/07/26 21:36:43 gson Exp $
+.\"
+.Dd Jun 30, 2000
+.Dt DNSSEC-SIGNZONE 8
+.Os BIND9 9
+.ds vT BIND9 Programmer's Manual
+.Sh NAME
+.Nm dnssec-signzone
+.Nd DNSSEC zone signing tool
+.Sh SYNOPSIS
+.Nm dnssec-signzone
+.Op Fl a
+.Op Fl c Ar cycle-time
+.Op Fl s Ar start-time
+.Op Fl e Ar end-time
+.Op Fl o Ar origin
+.Op Fl f Ar output-file
+.Op Fl p
+.Op Fl r Ar randomdev
+.Op Fl v Ar level
+.Ar zonefile
+.Op keyfile ....
+.Sh DESCRIPTION
+.Pp
+.Nm dnssec-signzone
+is used to sign a zone.
+Any
+.Ar .signedkey
+files for the zone to be signed should be present in the current
+directory, along with the keys that will be used to sign the zone.
+If no
+.Ar keyfile
+arguments are supplied, the default behaviour is to use all of the zone's
+keys that are present in the current directory.
+Providing specific
+.Ar keyfile
+arguments constrains
+.Nm dnssec-signzone
+to only use those keys for signing the zone.
+Each
+.Ar keyfile
+argument would be an identification string for a key created with
+.Xr dnssec-keygen 8 .
+If the zone to be signed has any secure subzones, the
+.Ar .signedkey
+files for those subzones need to be available in the
+current working directory used by
+.Nm dnssec-signzone .
+.Pp
+.Ar zonefile
+is the name of the unsigned zone file.
+Unless the file name is the same as the name of the zone, the
+.Fl o
+option should be given.
+.Ar origin
+will be the fully qualified domain origin for the zone.
+.Pp
+.Nm dnssec-signzone
+will generate NXT and SIG records for the zone and produce a signed
+version of the zone.
+If there is a
+.Ar signedkey
+file from the zone's parent, the parent's signatures will be
+incorporated into the generated signed zone file.
+The security status of delegations from the the signed zone 
+- i.e. whether the child zones are DNSSEC-aware or not - is
+set according to the presence or absence of a
+.Ar signedkey
+file for the child in case.
+.Pp
+By default,
+.Nm dnssec-signzone
+generates a file called
+.Ar zonefile.signed
+containing the signed zone file.
+The output file name can be overridden usign the
+.Fl f
+option.
+.\" Don't hyphenate YYYYMMDDHHMMSS
+.nh YYYYMMDDHHMMSS
+.Pp
+.Nm dnssec-signzone
+does not verify the signatures by default.
+The
+.Fl a
+option makes it verify the signatures it generated.
+.Pp
+The date and time when the generated
+SIG records become valid can be specified with the
+.Fl s
+option.
+.Ar start-time
+can either be an absolute or relative date.
+An absolute start time is indicated by a number in YYYYMMDDHHMMSS
+notation: 20000530144500 denotes 14:45:00 UTC on May 30th, 2000.
+A relative start time is supplied when
+.Ar start-time
+is given as +N: N seconds from the current time.
+If no
+.Fl s 
+option is supplied, the current date and time is used for the start
+time of the SIG records.
+.Pp
+The expiry date for the SIG records can be set by the
+.Fl e
+option.
+Note that in this context, the expiry date specifies when the SIG
+records are no longer valid, not when they are deleted from caches on name
+servers.
+.Ar end-date
+also represents an absolute or relative date.
+YYYYMMDDHHMMSS notation is used as before to indicate an absolute date
+and time.
+When
+.Ar end-date
+is +N,
+it indicates that the SIG records will expire in N seconds after their
+start date.
+If
+.Ar end-date
+is supplied as now+N,
+the SIG records will expire in N seconds after the current time.
+When no expiry date is set for the SIG records,
+.Nm dnssec-signzone
+defaults to an expire time of 30 days from the start time of the SIG
+records.
+.Pp
+When a previously signed zone is passed as input to
+.Nm dnssec-signzone ,
+records may be resigned.  Whether or not to resign records is configurable
+by using the
+.Fl c
+option, which specifies the cycle period as an offset from the current time
+(in seconds).  If a SIG record expires after the cycle period, it is retained.
+Otherwise, it is considered to be expiring soon, and
+.Nm dnssec-signzone
+will remove it and generate a new SIG record to replace it.
+.Pp
+The default cycle period is one quarter of the difference between the
+specified signature end and start dates.  So if the 
+.Fl e
+and 
+.Fl s
+options are not specified,
+.Nm dnssec-signzone
+generates signatures that are valid for 30 days from the current date
+by default, with a cycle period of 7.5 days.  Therefore, if any SIG records
+are due to expire in less than 7.5 days, they would be replaced
+with new ones.
+.Pp
+The
+.Fl p
+option instructs
+.Nm dnssec-signkey
+to use pseudo-random data when signing the keys.  This is faster, but
+less secure, than using genuinely random data for signing.
+This option may be useful when there are many child zone keysets to
+sign or if the entropy source is limited.
+It could also be used for short-lived keys and signatures that don't
+require as much protection against cryptanalysis, such as when the key
+will be discarded long before it could be compromised.
+.Pp
+.Nm dnssec-signzone
+may need random numbers in the process of signing the zone.
+If the system does not have a
+.Pa /dev/random
+device that can be used for generating random numbers,
+.Nm dnssec-signzone
+will prompt for keyboard input and use the time intervals between
+keystrokes to provide randomness.
+The
+.Fl r
+option overrides this behaviour, making
+.Nm dnssec-signzone
+use
+.Ar randomdev
+as a source of random data.
+.Pp
+An option of
+.Fl h
+makes
+.Nm dnssec-signzone
+print a short summary of its command line options
+and arguments.
+.Pp
+The
+.Fl v
+option can be used to make
+.Nm dnssec-signzone
+more verbose.
+As the debugging/tracing level
+.Ar level
+increases,
+.Nm dnssec-signzone
+generates increasingly detailed reports about what it is doing.
+The default level is zero.
+.Sh EXAMPLE
+The example below shows how
+.Nm dnssec-signzone
+could be used to sign the
+.Dv example.com
+zone with the key that was generated in the example given in the
+man page for
+.Xr dnssec-keygen 8 .
+The zone file for this zone is
+.Dv example.com ,
+which is the same as the origin, so there is no need to use the
+.Fl o
+option to set the origin.
+This zone file contains the keyset for
+.Dv example.com
+that was created by
+.Xr dnssec-makekeyset 8 .
+The zone's keys were either appended to the zone file or
+incorporated using a 
+.Dv $INCLUDE 
+statement.
+If there was a
+.Ar .signedkey
+file from the parent zone - i.e. 
+.Dv example.com.signedkey 
+- it should be present in the current directory.
+This allows the parent zone's signature to be included in the signed
+version of the
+.Dv example.com
+zone.
+.Pp
+.Dl # dnssec-signzone example.com Kexample.com.+003+26160
+.Pp
+.Nm dnssec-signzone
+will create a file called
+.Dv example.com.signed ,
+the signed version of the
+.Dv example.com
+zone.
+This file can then be referenced in a
+.Dv zone{}
+statement in
+.Pa /etc/named.conf
+so that it can be loaded by the name server.
+.Sh FILES
+.Pa /dev/random
+.Sh SEE ALSO
+.Xr RFC2535,
+.Xr dnssec-keygen 8 ,
+.Xr dnssec-makekeyset 8 ,
+.Xr dnssec-signkey 8 .
diff --git a/lib/dns/sec/dnssafe/LICENSE_RSA b/lib/dns/sec/dnssafe/LICENSE_RSA
new file mode 100644
index 0000000000..e448039b60
--- /dev/null
+++ b/lib/dns/sec/dnssafe/LICENSE_RSA
@@ -0,0 +1,43 @@
+			DNSSAFE LICENSE TERMS
+
+This BIND software includes the DNSsafe software from RSA Data
+Security, Inc., which is copyrighted software that can only be
+distributed under the terms of this license agreement.
+
+The DNSsafe software cannot be used or distributed separately from the
+BIND software.  You only have the right to use it or distribute it as
+a bundled, integrated product.
+
+The DNSsafe software can ONLY be used to provide authentication for
+resource records in the Domain Name System, as specified in RFC 2065
+and successors.  You cannot modify the BIND software to use the
+DNSsafe software for other purposes, or to make its cryptographic
+functions available to end-users for other uses.
+
+If you modify the DNSsafe software itself, you cannot modify its
+documented API, and you must grant RSA Data Security the right to use,
+modify, and distribute your modifications, including the right to use
+any patents or other intellectual property that your modifications
+depend upon.
+
+You must not remove, alter, or destroy any of RSA's copyright notices
+or license information.  When distributing the software to the Federal
+Government, it must be licensed to them as "commercial computer
+software" protected under 48 CFR 12.212 of the FAR, or 48 CFR
+227.7202.1 of the DFARS.
+
+You must not violate United States export control laws by distributing
+the DNSsafe software or information about it, when such distribution
+is prohibited by law.
+
+THE DNSSAFE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY
+WHATSOEVER.  RSA HAS NO OBLIGATION TO SUPPORT, CORRECT, UPDATE OR
+MAINTAIN THE RSA SOFTWARE.  RSA DISCLAIMS ALL WARRANTIES, EXPRESS,
+IMPLIED OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS.
+
+If you desire to use DNSsafe in ways that these terms do not permit,
+please contact RSA Data Security, Inc., 100 Marine Parkway, Redwood
+City, California 94065, USA, to discuss alternate licensing
+arrangements.